Skip to content

Commit 249114b

Browse files
author
MarcoFalke
committed
Merge #18314: tests: Add deserialization fuzzing of SnapshotMetadata (utxo_snapshot). Increase fuzzing coverage.
08eab0f tests: Add fuzzing of CSubNet, CNetAddr and CService related functions (practicalswift) 7a861a6 tests: Fuzz HasAllDesirableServiceFlags(...) and MayHaveUsefulAddressDB(...) (practicalswift) 47a2631 tests: Fuzz DecodeBase64PSBT(...) (practicalswift) d3d4892 tests: Simplify code by removing unwarranted use of unique_ptr:s (practicalswift) e57e670 tests: Fuzz DecodeHexBlk(...) (practicalswift) 117a706 tests: Fuzz RecursiveDynamicUsage(const std::shared_ptr<X>& p) (practicalswift) 81b58a3 tests: Fuzz operator!= of CService (practicalswift) c2c58f6 tests: Increase fuzzing coverage of DecompressScript(...) (practicalswift) 9f8d74a tests: Fuzz currently uncovered code path in TxToUniv(...) (practicalswift) 46ef4cf tests: Re-arrange test cases in parse_univalue to increase coverage (practicalswift) 516cc6f tests: Remove unit test from fuzzing harness (practicalswift) 7b169ca tests: Add deserialization fuzzing of SnapshotMetadata (utxo_snapshot), uint160 and uint256 (practicalswift) Pull request description: Add deserialization fuzzing of `SnapshotMetadata` (`utxo_snapshot`). Increase fuzzing coverage. ACKs for top commit: MarcoFalke: ACK 08eab0f 🗾 Tree-SHA512: 5dca2316d64b9eb1da9bbbb3831de285b1524cbe815e3dba0f9c4eac7f39b403eb26ee0bdd3d9409a1838e7226d783946ec0d251e514a99f68267a95ac56d416
2 parents 0eebe45 + 08eab0f commit 249114b

14 files changed

+108
-18
lines changed

‎src/Makefile.test.include

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@ FUZZ_TARGETS = \
8888
test/fuzz/script_ops \
8989
test/fuzz/scriptnum_ops \
9090
test/fuzz/service_deserialize \
91+
test/fuzz/snapshotmetadata_deserialize \
9192
test/fuzz/spanparsing \
9293
test/fuzz/strprintf \
9394
test/fuzz/sub_net_deserialize \
@@ -96,7 +97,9 @@ FUZZ_TARGETS = \
9697
test/fuzz/tx_in_deserialize \
9798
test/fuzz/tx_out \
9899
test/fuzz/txoutcompressor_deserialize \
99-
test/fuzz/txundo_deserialize
100+
test/fuzz/txundo_deserialize \
101+
test/fuzz/uint160_deserialize \
102+
test/fuzz/uint256_deserialize
100103

101104
if ENABLE_FUZZ
102105
noinst_PROGRAMS += $(FUZZ_TARGETS:=)
@@ -802,6 +805,12 @@ test_fuzz_sub_net_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
802805
test_fuzz_sub_net_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
803806
test_fuzz_sub_net_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
804807

808+
test_fuzz_snapshotmetadata_deserialize_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DSNAPSHOTMETADATA_DESERIALIZE=1
809+
test_fuzz_snapshotmetadata_deserialize_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
810+
test_fuzz_snapshotmetadata_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
811+
test_fuzz_snapshotmetadata_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
812+
test_fuzz_snapshotmetadata_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
813+
805814
test_fuzz_transaction_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
806815
test_fuzz_transaction_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
807816
test_fuzz_transaction_LDADD = $(FUZZ_SUITE_LD_COMMON)
@@ -838,6 +847,18 @@ test_fuzz_txundo_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
838847
test_fuzz_txundo_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
839848
test_fuzz_txundo_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
840849

850+
test_fuzz_uint160_deserialize_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DUINT160_DESERIALIZE=1
851+
test_fuzz_uint160_deserialize_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
852+
test_fuzz_uint160_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
853+
test_fuzz_uint160_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
854+
test_fuzz_uint160_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
855+
856+
test_fuzz_uint256_deserialize_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES) -DUINT256_DESERIALIZE=1
857+
test_fuzz_uint256_deserialize_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
858+
test_fuzz_uint256_deserialize_LDADD = $(FUZZ_SUITE_LD_COMMON)
859+
test_fuzz_uint256_deserialize_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
860+
test_fuzz_uint256_deserialize_SOURCES = $(FUZZ_SUITE) test/fuzz/deserialize.cpp
861+
841862
endif # ENABLE_FUZZ
842863

843864
nodist_test_test_bitcoin_SOURCES = $(GENERATED_TEST_FILES)

‎src/test/fuzz/base_encode_decode.cpp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
#include <test/fuzz/fuzz.h>
66

77
#include <base58.h>
8+
#include <psbt.h>
89
#include <util/string.h>
910
#include <util/strencodings.h>
1011

@@ -44,4 +45,8 @@ void test_one_input(const std::vector<uint8_t>& buffer)
4445
assert(encoded_string == TrimString(encoded_string));
4546
assert(ToLower(encoded_string) == ToLower(TrimString(random_encoded_string)));
4647
}
48+
49+
PartiallySignedTransaction psbt;
50+
std::string error;
51+
(void)DecodeBase64PSBT(psbt, random_encoded_string, error);
4752
}

‎src/test/fuzz/block.cpp

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919

2020
void initialize()
2121
{
22-
const static auto verify_handle = MakeUnique<ECCVerifyHandle>();
22+
static const ECCVerifyHandle verify_handle;
2323
SelectParams(CBaseChainParams::REGTEST);
2424
}
2525

@@ -59,5 +59,7 @@ void test_one_input(const std::vector<uint8_t>& buffer)
5959
}
6060
(void)GetBlockWeight(block);
6161
(void)GetWitnessCommitmentIndex(block);
62-
(void)RecursiveDynamicUsage(block);
62+
const size_t raw_memory_size = RecursiveDynamicUsage(block);
63+
const size_t raw_memory_size_as_shared_ptr = RecursiveDynamicUsage(std::make_shared<CBlock>(block));
64+
assert(raw_memory_size_as_shared_ptr > raw_memory_size);
6365
}

‎src/test/fuzz/descriptor_parse.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
void initialize()
1212
{
13-
static const auto verify_handle = MakeUnique<ECCVerifyHandle>();
13+
static const ECCVerifyHandle verify_handle;
1414
SelectParams(CBaseChainParams::REGTEST);
1515
}
1616

‎src/test/fuzz/deserialize.cpp

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
#include <key.h>
1414
#include <merkleblock.h>
1515
#include <net.h>
16+
#include <node/utxo_snapshot.h>
1617
#include <primitives/block.h>
1718
#include <protocol.h>
1819
#include <psbt.h>
@@ -34,7 +35,7 @@
3435
void initialize()
3536
{
3637
// Fuzzers using pubkey must hold an ECCVerifyHandle.
37-
static const auto verify_handle = MakeUnique<ECCVerifyHandle>();
38+
static const ECCVerifyHandle verify_handle;
3839
}
3940

4041
namespace {
@@ -214,9 +215,24 @@ void test_one_input(const std::vector<uint8_t>& buffer)
214215
#elif BLOCKTRANSACTIONSREQUEST_DESERIALIZE
215216
BlockTransactionsRequest btr;
216217
DeserializeFromFuzzingInput(buffer, btr);
218+
#elif SNAPSHOTMETADATA_DESERIALIZE
219+
SnapshotMetadata snapshot_metadata;
220+
DeserializeFromFuzzingInput(buffer, snapshot_metadata);
221+
#elif UINT160_DESERIALIZE
222+
uint160 u160;
223+
DeserializeFromFuzzingInput(buffer, u160);
224+
AssertEqualAfterSerializeDeserialize(u160);
225+
#elif UINT256_DESERIALIZE
226+
uint256 u256;
227+
DeserializeFromFuzzingInput(buffer, u256);
228+
AssertEqualAfterSerializeDeserialize(u256);
217229
#else
218230
#error Need at least one fuzz target to compile
219231
#endif
232+
// Classes intentionally not covered in this file since their deserialization code is
233+
// fuzzed elsewhere:
234+
// * Deserialization of CTxOut is fuzzed in test/fuzz/tx_out.cpp
235+
// * Deserialization of CMutableTransaction is fuzzed in src/test/fuzz/transaction.cpp
220236
} catch (const invalid_fuzzing_input_exception&) {
221237
}
222238
}

‎src/test/fuzz/eval_script.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
void initialize()
1414
{
15-
static const auto verify_handle = MakeUnique<ECCVerifyHandle>();
15+
static const ECCVerifyHandle verify_handle;
1616
}
1717

1818
void test_one_input(const std::vector<uint8_t>& buffer)

‎src/test/fuzz/hex.cpp

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
44

55
#include <core_io.h>
6+
#include <pubkey.h>
67
#include <primitives/block.h>
78
#include <rpc/util.h>
89
#include <test/fuzz/fuzz.h>
@@ -15,6 +16,10 @@
1516
#include <string>
1617
#include <vector>
1718

19+
void initialize() {
20+
static const ECCVerifyHandle verify_handle;
21+
}
22+
1823
void test_one_input(const std::vector<uint8_t>& buffer)
1924
{
2025
const std::string random_hex_string(buffer.begin(), buffer.end());
@@ -33,4 +38,6 @@ void test_one_input(const std::vector<uint8_t>& buffer)
3338
}
3439
CBlockHeader block_header;
3540
(void)DecodeHexBlockHeader(block_header, random_hex_string);
41+
CBlock block;
42+
(void)DecodeHexBlk(block, random_hex_string);
3643
}

‎src/test/fuzz/integer.cpp

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
#include <netbase.h>
1515
#include <policy/settings.h>
1616
#include <pow.h>
17+
#include <protocol.h>
1718
#include <pubkey.h>
1819
#include <rpc/util.h>
1920
#include <script/signingprovider.h>
@@ -216,4 +217,10 @@ void test_one_input(const std::vector<uint8_t>& buffer)
216217
stream >> deserialized_b;
217218
assert(b == deserialized_b && stream.empty());
218219
}
220+
221+
{
222+
const ServiceFlags service_flags = (ServiceFlags)u64;
223+
(void)HasAllDesirableServiceFlags(service_flags);
224+
(void)MayHaveUsefulAddressDB(service_flags);
225+
}
219226
}

‎src/test/fuzz/netaddress.cpp

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,4 +120,15 @@ void test_one_input(const std::vector<uint8_t>& buffer)
120120
const CNetAddr other_net_addr = ConsumeNetAddr(fuzzed_data_provider);
121121
(void)net_addr.GetReachabilityFrom(&other_net_addr);
122122
(void)sub_net.Match(other_net_addr);
123+
124+
const CService other_service{net_addr, fuzzed_data_provider.ConsumeIntegral<uint16_t>()};
125+
assert((service == other_service) != (service != other_service));
126+
(void)(service < other_service);
127+
128+
const CSubNet sub_net_copy_1{net_addr, other_net_addr};
129+
const CSubNet sub_net_copy_2{net_addr};
130+
131+
CNetAddr mutable_net_addr;
132+
mutable_net_addr.SetIP(net_addr);
133+
assert(net_addr == mutable_net_addr);
123134
}

‎src/test/fuzz/parse_univalue.cpp

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414

1515
void initialize()
1616
{
17-
static const auto verify_handle = MakeUnique<ECCVerifyHandle>();
17+
static const ECCVerifyHandle verify_handle;
1818
SelectParams(CBaseChainParams::REGTEST);
1919
}
2020

@@ -35,21 +35,31 @@ void test_one_input(const std::vector<uint8_t>& buffer)
3535
}
3636
try {
3737
(void)ParseHashO(univalue, "A");
38+
} catch (const UniValue&) {
39+
} catch (const std::runtime_error&) {
40+
}
41+
try {
3842
(void)ParseHashO(univalue, random_string);
3943
} catch (const UniValue&) {
4044
} catch (const std::runtime_error&) {
4145
}
4246
try {
4347
(void)ParseHashV(univalue, "A");
48+
} catch (const UniValue&) {
49+
} catch (const std::runtime_error&) {
50+
}
51+
try {
4452
(void)ParseHashV(univalue, random_string);
4553
} catch (const UniValue&) {
4654
} catch (const std::runtime_error&) {
4755
}
4856
try {
4957
(void)ParseHexO(univalue, "A");
58+
} catch (const UniValue&) {
59+
}
60+
try {
5061
(void)ParseHexO(univalue, random_string);
5162
} catch (const UniValue&) {
52-
} catch (const std::runtime_error&) {
5363
}
5464
try {
5565
(void)ParseHexUV(univalue, "A");
@@ -59,6 +69,10 @@ void test_one_input(const std::vector<uint8_t>& buffer)
5969
}
6070
try {
6171
(void)ParseHexV(univalue, "A");
72+
} catch (const UniValue&) {
73+
} catch (const std::runtime_error&) {
74+
}
75+
try {
6276
(void)ParseHexV(univalue, random_string);
6377
} catch (const UniValue&) {
6478
} catch (const std::runtime_error&) {

0 commit comments

Comments
 (0)